| |||||||||||||
|
| |||||||||||||
Rainbow tables for password crackingRainbow tables for password crackingPosted Nov 17, 2006 2:53 UTC (Fri) by zaitseff (guest, #851)Parent article: Rainbow tables for password cracking
The best defense against rainbow tables is ‘salt’,
which has been a part of UNIX passwords since near the beginning of time
(UNIX epoch time anyway) […] Linux MD5 passwords store the salt
between two dollar signs in the password field in
Unfortunately, it seems as if all of my many Debian-based
systems use "1" as the salt. Are other GNU/Linux systems different? I am
guessing that this would depend on the version of the
(Log in to post comments)
Rainbow tables for password cracking Posted Nov 17, 2006 4:14 UTC (Fri) by jake (editor, #205) [Link] > Unfortunately, it seems as if all of my many Debian-based systems use "1" as the salt.
No, the salt is actually between the next 2 dollar signs ... $1$salt$hash
$1$ indicates the format of the password ...
hope that helps!
jake
Rainbow tables for password cracking Posted Nov 18, 2006 14:39 UTC (Sat) by jond (subscriber, #37669) [Link] Very interesting. Forgive my ignorance, but how is the hash then stored? I use md5 passwords (at least I told the installer to do so ;).
If I setup a temp user with password Ior3yaeW, I get the following:
temp:$1$.K4dEqjn$pHNfFwq4BAUHf7TcUScuJ1:13470:0:99999:7:::
so if I echo Ior3yaeW.K4dEqjn | md5sum ; what do I do to _that_ to get pHNfFwq4BAUHf7TcUScuJ1 ?
Rainbow tables for password cracking Posted Nov 22, 2006 1:33 UTC (Wed) by dmenest (guest, #4017) [Link] The MD5 password hash is a lot more complicated than a simple MD5 hash. In fact, the code to generate the password hash calls the simple MD5 hash routine more than 1000 times. So you won't be able to do it easily on the command line without a program that calls the crypt() function for you.
|
|
||||||||||||